chemlab 0.0.1

data/qa/specs/features/ee/browser_ui/3_create/repository/assign_code_owners_spec.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module QA
+  context 'Create' do
+    describe 'Codeowners' do
+      # Create one user to be the assigned approver and another user who will not be an approver
+      let(:approver) { Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_username_1, Runtime::Env.gitlab_qa_password_1) }
+      let(:non_approver) { Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_username_2, Runtime::Env.gitlab_qa_password_2) }
+
+      let(:project) do
+        Resource::Project.fabricate_via_api! do |project|
+          project.name = "assign-approvers"
+          project.initialize_with_readme = true
+        end
+      end
+      let(:branch_name) { 'protected-branch' }
+
+      before do
+        project.add_member(approver, Resource::Members::AccessLevel::DEVELOPER)
+        project.add_member(non_approver, Resource::Members::AccessLevel::DEVELOPER)
+
+        Flow::Login.sign_in
+
+        project.visit!
+      end
+
+      it 'merge request assigns code owners as approvers' do
+        # Commit CODEOWNERS to master
+        Resource::Repository::Commit.fabricate_via_api! do |commit|
+          commit.project = project
+          commit.commit_message = 'Add CODEOWNERS and test files'
+          commit.add_files(
+            [
+              {
+                file_path: 'CODEOWNERS',
+                content: <<~CONTENT
+                  CODEOWNERS @#{approver.username}
+                CONTENT
+              }
+            ]
+          )
+        end
+
+        # Create a projected branch that requires approval from code owners
+        Resource::ProtectedBranch.fabricate! do |protected_branch|
+          protected_branch.branch_name = branch_name
+          protected_branch.project = project
+        end
+
+        # Push a new CODEOWNERS file
+        Resource::Repository::Push.fabricate! do |push|
+          push.repository_http_uri = project.repository_http_location.uri
+          push.branch_name = branch_name + '-patch'
+          push.file_name = 'CODEOWNERS'
+          push.file_content = <<~CONTENT
+            CODEOWNERS @#{non_approver.username}
+          CONTENT
+        end
+
+        # Create a merge request
+        Resource::MergeRequest.fabricate! do |merge_request|
+          merge_request.project = project
+          merge_request.target_new_branch = false
+          merge_request.source_branch = branch_name + '-patch'
+          merge_request.target_branch = branch_name
+          merge_request.no_preparation = true
+        end.visit!
+
+        # Check that the merge request assigns the original code owner as an
+        # approver (because the current CODEOWNERS file in the master branch
+        # doesn't have the new owner yet)
+        Page::MergeRequest::Show.perform do |show|
+          show.edit!
+          approvers = show.approvers
+
+          expect(approvers.size).to eq(1)
+          expect(approvers).to include(approver.name)
+          expect(approvers).not_to include(non_approver.name)
+        end
+      end
+    end
+  end
+end

data/qa/specs/features/ee/browser_ui/3_create/repository/code_owners_spec.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module QA
+  context 'Create' do
+    describe 'Codeowners' do
+      let(:files) do
+        [
+          {
+            name: 'file.txt',
+            content: 'foo'
+          },
+          {
+            name: 'README.md',
+            content: 'bar'
+          }
+        ]
+      end
+
+      before do
+        # Add two new users to a project as members
+        Flow::Login.sign_in
+
+        @user = Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_username_1, Runtime::Env.gitlab_qa_password_1)
+        @user2 = Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_username_2, Runtime::Env.gitlab_qa_password_2)
+
+        @project = Resource::Project.fabricate_via_api! do |project|
+          project.name = "codeowners"
+        end
+        @project.visit!
+
+        Page::Project::Menu.perform(&:go_to_members_settings)
+        Page::Project::Settings::Members.perform do |members_page|
+          members_page.add_member(@user.username)
+          members_page.add_member(@user2.username)
+        end
+      end
+
+      it 'displays owners specified in CODEOWNERS file' do
+        codeowners_file_content =
+          <<-CONTENT
+            * @#{@user2.username}
+            *.txt @#{@user.username}
+          CONTENT
+        files << {
+          name: 'CODEOWNERS',
+          content: codeowners_file_content
+        }
+
+        # Push CODEOWNERS and test files to the project
+        Resource::Repository::ProjectPush.fabricate! do |push|
+          push.project = @project
+          push.files = files
+          push.commit_message = 'Add CODEOWNERS and test files'
+        end
+        @project.visit!
+
+        # Check the files and code owners
+        Page::Project::Show.perform do |project_page|
+          project_page.click_file 'file.txt'
+        end
+
+        expect(page).to have_content(@user.name)
+        expect(page).not_to have_content(@user2.name)
+
+        @project.visit!
+        Page::Project::Show.perform do |project_page|
+          project_page.click_file 'README.md'
+        end
+
+        expect(page).to have_content(@user2.name)
+        expect(page).not_to have_content(@user.name)
+      end
+    end
+  end
+end

data/qa/specs/features/ee/browser_ui/3_create/repository/file_locking_spec.rb

@@ -0,0 +1,161 @@
+# frozen_string_literal: true
+
+module QA
+  context 'Create' do
+    describe 'File Locking' do
+      before do
+        Flow::Login.sign_in
+
+        @user_one = Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_username_1, Runtime::Env.gitlab_qa_password_1)
+        @user_two = Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_username_2, Runtime::Env.gitlab_qa_password_2)
+
+        @project = Resource::Project.fabricate_via_api! do |project|
+          project.name = 'file_locking'
+        end
+
+        Resource::Repository::ProjectPush.fabricate! do |push|
+          push.project = @project
+          push.file_name = 'file'
+          push.file_content = SecureRandom.hex(100000)
+        end
+
+        add_to_project user: @user_one
+        add_to_project user: @user_two
+
+        Resource::ProtectedBranch.unprotect_via_api! do |branch|
+          branch.project = @project
+          branch.branch_name = 'master'
+        end
+      end
+
+      it 'locks a directory and tries to push as a second user' do
+        push branch: 'master', file: 'directory/file', as_user: @user_one
+
+        sign_out_and_sign_in_as user: @user_one
+        go_to_directory
+        click_lock
+
+        expect_error_on_push for_file: 'directory/file', as_user: @user_two
+        expect_no_error_on_push for_file: 'directory/file', as_user: @user_one
+      end
+
+      it 'locks a file and tries to push as a second user' do
+        sign_out_and_sign_in_as user: @user_one
+        go_to_file
+        click_lock
+
+        expect_error_on_push as_user: @user_two
+        expect_no_error_on_push as_user: @user_one
+      end
+
+      it 'checks file locked by other user to be disabled' do
+        go_to_file
+        click_lock
+        sign_out_and_sign_in_as user: @user_one
+        go_to_file
+
+        Page::File::Show.perform do |show|
+          expect(show).to have_lock_button_disabled
+        end
+      end
+
+      it 'creates a merge request and fails to merge', quarantine: { issue: 'https://gitlab.com/gitlab-org/gitlab/issues/40125', type: :bug } do
+        push branch: 'test', as_user: @user_one
+
+        merge_request = Resource::MergeRequest.fabricate_via_api! do |merge_request|
+          merge_request.project = @project
+          merge_request.source_branch = 'test'
+          merge_request.target_branch = 'master'
+          merge_request.no_preparation = true
+        end
+
+        go_to_file
+        click_lock
+        sign_out_and_sign_in_as user: @user_one
+        try_to_merge merge_request: merge_request
+        Page::MergeRequest::Show.perform(&:wait_for_merge_request_error_message)
+        expect(page).to have_text("locked by #{admin_username}")
+      end
+
+      it 'locks a file and unlocks in list' do
+        sign_out_and_sign_in_as user: @user_one
+        go_to_file
+        click_lock
+        @project.visit!
+
+        Page::Project::Menu.perform(&:go_to_repository_locked_files)
+        EE::Page::Project::PathLocks::Index.perform do |list|
+          expect(list).to have_file_with_title 'file'
+          list.unlock_file 'file'
+        end
+
+        expect_no_error_on_push as_user: @user_two
+      end
+
+      def try_to_merge(merge_request:)
+        merge_request.visit!
+        Page::MergeRequest::Show.perform do |show|
+          show.try_to_merge!
+        end
+      end
+
+      def sign_out_and_sign_in_as(user:)
+        Page::Main::Login.perform do |login|
+          login.sign_out_and_sign_in_as user: user
+        end
+      end
+
+      def go_to_file
+        @project.visit!
+        Page::Project::Show.perform do |project_page|
+          project_page.click_file 'file'
+        end
+      end
+
+      def go_to_directory
+        @project.visit!
+        Page::Project::Show.perform do |project_page|
+          project_page.click_file 'directory'
+        end
+      end
+
+      def click_lock
+        Page::File::Show.perform(&:lock)
+      end
+
+      def add_to_project(user:)
+        Resource::ProjectMember.fabricate_via_api! do |member|
+          member.user = user
+          member.project = @project
+          member.access_level = member.level[:developer]
+        end
+      end
+
+      def push(branch: 'master', file: 'file', as_user:)
+        Resource::Repository::ProjectPush.fabricate! do |push|
+          push.project = @project
+          push.new_branch = false unless branch != 'master'
+          push.file_name = file
+          push.file_content = SecureRandom.hex(100000)
+          push.user = as_user
+          push.branch_name = branch
+        end
+      end
+
+      def expect_error_on_push(for_file: 'file', as_user:)
+        expect { push branch: 'master', file: for_file, as_user: as_user }.to raise_error(
+          QA::Git::Repository::RepositoryCommandError)
+      end
+
+      def expect_no_error_on_push(for_file: 'file', as_user:)
+        expect { push branch: 'master', file: for_file, as_user: as_user }.not_to raise_error
+      end
+
+      def admin_username
+        Resource::User.fabricate_via_api! do |user|
+          user.username = Runtime::User.username
+        end.name
+      end
+    end
+  end
+end

data/qa/specs/features/ee/browser_ui/3_create/repository/pull_mirroring_over_http_spec.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module QA
+  context 'Create' do
+    # Use Admin credentials as a workaround for a permissions bug
+    # See https://gitlab.com/gitlab-org/gitlab/issues/13769
+    describe 'Pull mirror a repository over HTTP', :requires_admin do
+      it 'configures and syncs a (pull) mirrored repository with password auth' do
+        Flow::Login.sign_in_as_admin
+
+        source = Resource::Repository::ProjectPush.fabricate! do |project_push|
+          project_push.project_name = 'pull-mirror-source-project'
+          project_push.file_name = 'README.md'
+          project_push.file_content = '# This is a pull mirroring test project'
+          project_push.commit_message = 'Add README.md'
+        end
+        source_project_uri = source.project.repository_http_location.uri
+        source_project_uri.user = CGI.escape(Runtime::User.admin_username)
+
+        target_project = Resource::Project.fabricate_via_api! do |project|
+          project.name = 'pull-mirror-target-project'
+        end
+        target_project.visit!
+
+        Page::Project::Menu.perform(&:go_to_repository_settings)
+        Page::Project::Settings::Repository.perform do |settings|
+          settings.expand_mirroring_repositories do |mirror_settings|
+            # Configure the target project to pull from the source project
+            mirror_settings.repository_url = source_project_uri
+            mirror_settings.mirror_direction = 'Pull'
+            mirror_settings.authentication_method = 'Password'
+            mirror_settings.password = Runtime::User.admin_password
+            mirror_settings.mirror_repository
+            mirror_settings.update source_project_uri
+          end
+        end
+
+        # Check that the target project has the commit from the source
+        target_project.visit!
+        expect(page).to have_content("README.md")
+        expect(page).to have_content("This is a pull mirroring test project")
+        expect(page).to have_content("Mirrored from #{masked_url(source_project_uri)}")
+      end
+
+      def masked_url(url)
+        url.password = '*****'
+        url.user = '*****'
+        url
+      end
+    end
+  end
+end

data/qa/specs/features/ee/browser_ui/3_create/repository/pull_mirroring_over_ssh_with_key_spec.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module QA
+  context 'Create' do
+    describe 'Pull mirror a repository over SSH with a private key', quarantine: { issue: 'https://gitlab.com/gitlab-org/gitlab/-/issues/216297', type: :investigating } do
+      let(:source) do
+        Resource::Repository::ProjectPush.fabricate! do |project_push|
+          project_push.project_name = 'pull-mirror-source-project'
+          project_push.file_name = 'README.md'
+          project_push.file_content = '# This is a pull mirroring test project'
+          project_push.commit_message = 'Add README.md'
+        end
+      end
+      let(:source_project_uri) { source.project.repository_ssh_location.uri }
+      let(:target_project) do
+        Resource::Project.fabricate_via_api! do |project|
+          project.name = 'pull-mirror-target-project'
+        end
+      end
+
+      before do
+        Flow::Login.sign_in
+
+        target_project.visit!
+      end
+
+      it 'configures and syncs a (pull) mirrored repository' do
+        # Configure the target project to pull from the source project
+        # And get the public key to be used as a deploy key
+        Page::Project::Menu.perform(&:go_to_repository_settings)
+        public_key = Page::Project::Settings::Repository.perform do |settings|
+          settings.expand_mirroring_repositories do |mirror_settings|
+            mirror_settings.repository_url = source_project_uri
+            mirror_settings.mirror_direction = 'Pull'
+            mirror_settings.authentication_method = 'SSH public key'
+            mirror_settings.detect_host_keys
+            mirror_settings.mirror_repository
+            mirror_settings.public_key source_project_uri
+          end
+        end
+
+        # Add the public key to the source project as a deploy key
+        Resource::DeployKey.fabricate! do |deploy_key|
+          deploy_key.project = source.project
+          deploy_key.title = "pull mirror key #{Time.now.to_f}"
+          deploy_key.key = public_key
+        end
+
+        # Sync the repositories
+        target_project.visit!
+        Page::Project::Menu.perform(&:go_to_repository_settings)
+        Page::Project::Settings::Repository.perform do |settings|
+          settings.expand_mirroring_repositories do |mirror_settings|
+            mirror_settings.update source_project_uri
+          end
+        end
+
+        # Check that the target project has the commit from the source
+        target_project.visit!
+        expect(page).to have_content('README.md')
+        expect(page).to have_content('This is a pull mirroring test project')
+        expect(page).to have_content("Mirrored from #{masked_url(source_project_uri)}")
+      end
+
+      def masked_url(url)
+        url.user = '*****'
+        url
+      end
+    end
+  end
+end

data/qa/specs/features/ee/browser_ui/3_create/repository/push_rules_spec.rb

@@ -0,0 +1,202 @@
+# frozen_string_literal: true
+
+module QA
+  context 'Create' do
+    context 'Push Rules' do
+      describe 'using non signed commits' do
+        before(:context) do
+          prepare
+
+          @file_name_limitation = 'denied_file'
+          @file_size_limitation = 1
+          @authors_email_limitation = %{(#{Regexp.escape(@creator.email)}|#{@root.email})}
+          @branch_name_limitation = 'master'
+          @needed_phrase_limitation = 'allowed commit'
+          @deny_message_phrase_limitation = 'denied commit'
+
+          Page::Project::Settings::Repository.perform do |repository|
+            repository.expand_push_rules do |push_rules|
+              push_rules.fill_file_name(@file_name_limitation)
+              push_rules.fill_file_size(@file_size_limitation)
+              push_rules.fill_author_email(@authors_email_limitation)
+              push_rules.fill_branch_name(@branch_name_limitation)
+              push_rules.fill_commit_message_rule(@needed_phrase_limitation)
+              push_rules.fill_deny_commit_message_rule(@deny_message_phrase_limitation)
+              push_rules.check_prevent_secrets
+              push_rules.check_restrict_author
+              push_rules.check_deny_delete_tag
+              push_rules.click_submit
+            end
+          end
+        end
+
+        it 'allows an unrestricted push' do
+          expect_no_error_on_push(file: standard_file)
+        end
+
+        it 'restricts files by name and size' do
+          large_file = [{
+            name: 'file',
+            content: SecureRandom.hex(1000000)
+          }]
+          wrongly_named_file = [{
+            name: @file_name_limitation,
+            content: SecureRandom.hex(100)
+          }]
+
+          expect_error_on_push(file: large_file,
+            error: 'File "file" is larger than the allowed size of 1 MB')
+          expect_error_on_push(file: wrongly_named_file,
+            error: Regexp.escape("File name #{@file_name_limitation} was blacklisted by the pattern #{@file_name_limitation}"))
+        end
+
+        it 'restricts users by email format' do
+          gitlab_user = Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_username_2, Runtime::Env.gitlab_qa_password_2)
+          @project.add_member(gitlab_user, Resource::Members::AccessLevel::MAINTAINER)
+
+          expect_error_on_push(file: standard_file, user: gitlab_user,
+            error: Regexp.escape("Committer's email '#{gitlab_user.email}' does not follow the pattern '#{@authors_email_limitation}'"))
+        end
+
+        it 'restricts branches by branch name' do
+          expect_error_on_push(file: standard_file, branch: 'forbidden_branch',
+            error: Regexp.escape("Branch name does not follow the pattern '#{@branch_name_limitation}'"))
+        end
+
+        it 'restricts commit by message format' do
+          expect_no_error_on_push(file: standard_file, commit_message: @needed_phrase_limitation)
+          expect_error_on_push(file: standard_file, commit_message: 'forbidden message',
+            error: Regexp.escape("Commit message does not follow the pattern '#{@needed_phrase_limitation}'"))
+          expect_error_on_push(file: standard_file, commit_message: "#{@needed_phrase_limitation} - #{@deny_message_phrase_limitation}",
+            error: Regexp.escape("Commit message contains the forbidden pattern '#{@deny_message_phrase_limitation}'"))
+        end
+
+        it 'restricts committing files with secrets' do
+          secret_file = [{
+            name: 'id_rsa',
+            content: SecureRandom.hex(100)
+          }]
+
+          expect_error_on_push(file: secret_file,
+            error: Regexp.escape('File name id_rsa was blacklisted by the pattern id_rsa$'))
+        end
+
+        it 'restricts commits by user' do
+          expect_error_on_push(file: standard_file, user: @root,
+            error: Regexp.escape("Author '#{@root.email}' is not a member of team"))
+        end
+
+        it 'restricts removal of tag' do
+          tag = Resource::Tag.fabricate_via_api! do |tag|
+            tag.project = @project
+            tag.ref = 'master'
+            tag.name = 'test_tag'
+          end
+
+          expect_error_on_push(file: standard_file, tag: tag.name,
+            error: 'You cannot delete a tag')
+        end
+      end
+
+      describe 'with commits restricted to verified emails' do
+        before do
+          prepare
+
+          Page::Project::Settings::Repository.perform do |repository|
+            repository.expand_push_rules do |push_rules|
+              push_rules.check_committer_restriction
+              push_rules.click_submit
+            end
+          end
+        end
+
+        it 'rejects unverified emails' do
+          expect_no_error_on_push(file: standard_file)
+          expect_error_on_push(file: standard_file, user: @root,
+            error: 'You can only push commits that were committed with one of your own verified emails')
+        end
+      end
+
+      describe 'using signed commits' do
+        before do
+          prepare
+
+          Page::Project::Settings::Repository.perform do |repository|
+            repository.expand_push_rules do |push_rules|
+              push_rules.check_reject_unsigned_commits
+              push_rules.click_submit
+            end
+          end
+
+          @gpg = Resource::UserGPG.fabricate_via_api!
+        end
+
+        it 'restricts to signed commits' do
+          expect_no_error_on_push(file: standard_file, gpg: @gpg)
+          expect_error_on_push(file: standard_file, error: 'Commit must be signed with a GPG key')
+        end
+      end
+
+      def standard_file
+        [{
+           name: 'file',
+           content: SecureRandom.hex(100)
+         }]
+      end
+
+      def push(commit_message:, branch:, file:, user:, tag:, gpg:)
+        Resource::Repository::ProjectPush.fabricate! do |push|
+          push.project = @project
+          push.commit_message = commit_message
+          push.new_branch = branch != 'master'
+          push.branch_name = branch
+          push.user = user if user != @root
+          push.files = file if tag.nil?
+          push.tag_name = tag unless tag.nil?
+          push.gpg_key_id = gpg.key_id unless gpg.nil?
+        end
+      end
+
+      def expect_no_error_on_push(commit_message: 'allowed commit', branch: 'master', file:, user: @creator, tag: nil, gpg: nil)
+        expect do
+          push commit_message: commit_message, branch: branch, file: file, user: user, tag: tag, gpg: gpg
+        end.not_to raise_error
+      end
+
+      def expect_error_on_push(commit_message: 'allowed commit', branch: 'master', file:, user: @creator, tag: nil, gpg: nil, error: nil)
+        expect do
+          push commit_message: commit_message, branch: branch, file: file, user: user, tag: tag, gpg: gpg
+        end.to raise_error(QA::Git::Repository::RepositoryCommandError, /#{error}/)
+      end
+
+      def prepare
+        Flow::Login.sign_in
+
+        @creator = Resource::User.fabricate_via_api! do |user|
+          user.username = Runtime::User.username
+          user.password = Runtime::User.password
+        end
+
+        @root = Resource::User.new.tap do |user|
+          user.username = 'root'
+          user.name = 'GitLab QA'
+          user.email = 'root@gitlab.com'
+          user.password = nil
+        end
+
+        @project = Resource::Project.fabricate_via_api! do |project|
+          project.name = 'push_rules'
+        end
+
+        Resource::Repository::ProjectPush.fabricate! do |push|
+          push.project = @project
+          push.files = standard_file
+        end
+
+        @project.visit!
+
+        Page::Project::Menu.perform(&:go_to_repository_settings)
+      end
+    end
+  end
+end